Autopilot Troubleshooting - how I do it

 You might find troubleshooting Autopilot Enrollment Status Page (ESP) little difficult, when it fails. In most cases, it is about application installation failures. Unfortunately, troubleshooting capabilities are not yet such good as it was with SCCM (Configuration Manager). Let me give you few tips and make it little bit easier.

Some Challenges with known methods

  • In Event viewer you might find MSIINSTALLER events without any errors during Autopilot ESP crash. I've seen this many times.
  • Managed Apps view in Intune Console monitoring might show you all Apps installation is still pending / waiting, because the installation status is not there yet. If you then wait and later login to the workstation, apps will eventually get installed and you can't track, which one causes the Autopilot interruption.
  • IntuneManagementExtension.log is full of data, has multiple errors and you don't know what to look there. This is my main focus in this blog.
  • There are few Autopilot troubleshooting guides already, like Windows Autopilot Troubleshooting - Beginners Guide - 5 Step (anoopcnair.com) but I think they are too tricky and not focusing on the main issue - application installation failures.
  • You can also collect easily all MDM diagnostic files to one package, but you need to know how to work with that amount of data

Quick tips

Before going deep dive into logs, I have some easy suggestions how to make Autopilot ESP work smooth as possible

Prereqs

  • If you don't want to get blind by reading log file in Notepad, I suggest you get hands on log file reading tool. I use good old CMtrace taken from SCCM. You can safely use it with Intune, because in license terms, CM and Intune are from the same product family.
  • You might want to create Win32 package of CMtrace.exe and add it to Autopilot installation chain. This way you will always have it when needed. I copy it directly under C:\Windows

Troubleshooting steps - how I do it

Like we all know, with Shift+F10 combination you have the access to Command Prompt during autopilot process and during its failure. There with MMC you can launch eventviewer or other consoles, and open log file with notepad or with cmtrace.

No alt text provided for this image

1 First, if you open Event Viewer \ Windows Logs \Application and filter it with MsiInstaller Source (see pic), you get all the installation events and the time line, when all installations happened. Understanding the time window minute by minute is especially important, if you weren't physically present and watching when ESP page fails and not marking time occurrences with pen and paper. First events will show you the Intune Extension component installation and here you understand, at what time basically entire Autopilot processing began.

No alt text provided for this image

2. With the CMtrace you then should open C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log file. It is also good idea to keep Event Viewer window side by side. In pic below you see example of exact event tracked in both logging systems.

No alt text provided for this image

3. So, considering the fact, that the log file contains all the possible Intune data in one file (not like the SCCM containing single log files for each functions, like appenforce.log which was very usefull), you will see many many lines for 1 second there. Instead of scrolling every line with time stamps, you can use keywords to track down the exact info you need to troubleshoot Application installation errors. I will provide these keywords for you.

No alt text provided for this image

  • Sequence will reveal you the application list and order, what policies and apps installation has picked up for Autopilot process.
  • You can use (name= or lpExitCode as key words to track down single application process. Here is the example of all lines which are included in Win32 app application installation.

Here, let me provide you the list of all lines which are about Win32 app installation. Typically they are all around the log file and you will not see it in one section like this, but this text box will give you the idea, what keywords to search with cmtrace.

[Win32App] #################### Start processing SelectedApps ####################
[Win32App] In EspPhase: DeviceSetup
[Win32App] Got 9 Win32App(s)
[Win32App] ExecManager: processing targeted app (name='7-zip x64 19.00', id='047f275d-a240-49b5-9bc0-c2550ab21f83') with intent=3, appApplicabilityStateDueToAssginmentFilters= for user session 0
[Win32App] ===Step=== InstallBehavior RegularWin32App, Intent 3, UninstallCommandLine Noneed.cmd
msiexec.exe /i "7-zip.msi" /quiet /norestart
[Win32App] Installation is done, collecting result
[Win32App] lpExitCode 0
[Win32App] lpExitCode is defined as Success
[Win32App] Got installationState: Completed

Comments

Post a Comment

Popular posts from this blog

4 Most common Issues while registering devices with Microsoft Intune MDM

Image
  The built-in Mobile Device Management (MDM) for Office 365 helps you secure and manage your users' mobile devices like iPhones, iPads, Androids, and Windows phones. You can create and manage device security policies, remotely wipe a device, and view detailed device reports. During implementation or deployment, there are some common issues which occur in many of the environment  1-   Windows Update Sometimes you will notice that Windows Update is showing-Up-To-Date but in actual, the version needed for the MDM Registration is not updating automatically and eventually fails every time in the loop Solution Suggested Go to this  link  upgrade your Windows 10 to the latest version You will find a home page like the screenshot below. Click on UPDATE Now button. It will download a .exe file. Run the file and click on UPDATE Now button and press YES. Here it will update your Windows 10 to the Latest Version Note:  You can still work during downloading a...
Read more

Managing Windows Updates with Intune: Best Practices with Update Rings

Image
  Keeping Windows devices up to date is one of the most critical, and often most overlooked, aspects of endpoint security. With Microsoft Intune, you can manage Windows updates centrally using Update Rings , giving you control over when updates install, how users experience restarts, and how you test updates before broad deployment. In this guide, I’ll walk you through: What update rings are Why they’re essential for patch compliance How to configure them in Intune Best practices for rollout and user experience 1. What Are Windows Update Rings in Intune? Update rings in Intune allow you to: Define when and how Windows updates are delivered Set deadlines for installation and restarts Delay feature updates (e.g., to test before production) Control user experience during updates They apply to Windows 10 and 11 devices enrolled in Intune, including those provisioned via Autopilot. 2. Why Update Management Matters Without structured update management, you risk: Devices missing crit...
Read more

The Intune Device Lifecycle: From Onboarding to Retirement (Best Practices)

  Managing endpoints isn’t just about deployment, it’s about handling the entire device lifecycle : from onboarding and day-to-day management to secure deprovisioning when a device is no longer in use. Microsoft Intune provides a streamlined, policy-driven approach to each phase of this lifecycle, and when done right, it reduces IT overhead, increases security, and improves the user experience. In this post, I’ll walk you through the key stages of managing a device in Intune from start to finish, and how to handle each one effectively. Stage 1: Provisioning & Onboarding This is where the device journey begins, and it sets the tone for everything that follows. Tools and features to use: Windows Autopilot for zero-touch setup Enrollment Status Page (ESP) to control setup sequence Dynamic groups to assign configurations automatically Baseline security policies (compliance, Defender, encryption) Goal: Make the first experience smooth, secure, and consistent for every user. Sta...
Read more